Overview

overview

10

Static

static

8

d3127b922e...8.xlsm

windows7_x64

10

d3127b922e...8.xlsm

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    104s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    03-03-2021 19:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d3127b922e70794c42034aaf238cb358.xlsm

  • Size

    359KB

  • MD5

    d3127b922e70794c42034aaf238cb358

  • SHA1

    0ab11895b528eeabf2e544567f0f467d27b7a1fb

  • SHA256

    8bac502d02aebef57de2e4b324a71cb0d843c7cc1c66082ab37405e83afa6993

  • SHA512

    860afda64d73a9761faaeb096cdb8294c93121e4b3c85bbae9e3c66f650234a9721c6801afd11af02b376936d3b6ad32ee20b7ce526ce54ded97e358b9a15284

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d3127b922e70794c42034aaf238cb358.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1604
  • C:\Windows\system32\wbem\wmic.exe
    wmic os get /format:"C:\Users\Admin\AppData\Roaming\357BF.xsl"
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//p41ld.dll RunXml
      2⤵
        PID:1648

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\357BF.xsl
      MD5

      7d698fe6441ba051b9445fb35c6296c7

      SHA1

      e7c940533df3415b17416701d2da27602843fd84

      SHA256

      4c2ef808ef4bfd79dcc35a89c3f8eb1743a9e94b80e4372da72bdce4bc712934

      SHA512

      2dcf1f94e68669f8ac91bd3a66bcd11332b9722a22d8f0c5e8daf37c35da7d6e817c8f09504992b73624d1f63660f956798c067fff922a987ded7439f9ba54d2

      Download Submit
    • C:\Windows\Temp\p41ld.dll
      MD5

      4d40385dcd71235ca36f3e3de109feaf

      SHA1

      375c4a47c164b5f68934e9f3a91c8001c7151954

      SHA256

      44d07ecc26c8d4468ba8df05af6016ac0d45624979c80622cbbdb95091702991

      SHA512

      a2fb6a5129b83c609b2cba5e61b7e605c0d85c27af7eaa61d390bb659b824f96f750e45c8911b60545a70e7b29aed3b0e100044b5b0d713be438190ccc1dac71

      Download Submit
    • memory/304-7-0x000007FEF6840000-0x000007FEF6ABA000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/1604-2-0x000000002F911000-0x000000002F914000-memory.dmp
      Filesize

      12KB

      Download
    • memory/1604-3-0x00000000719C1000-0x00000000719C3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1604-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1604-5-0x00000000059F0000-0x00000000059F2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1648-8-0x0000000000000000-mapping.dmp
      Download